Analysis
- geolocation tags
- max time kernel
898s - max time network
897s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
06/08/2026, 04:26
General
- Target SYSWOW64.exe
- Size 955KB
- Sample260806-e2hsysshrb
- SHA256 ef74d1c29ee00f4ebc57c52426c2ac194a34f8f0c150443e95fc1d4f2a13403b
Malware Config
Extracted
-
quasar
-
encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SYSWOW64.exe"C:\Users\Admin\AppData\Local\Temp\SYSWOW64.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5320-0-0x000001ACB9AF0000-0x000001ACB9BE4000-memory.dmp
memory/5320-1-0x000001ACBB930000-0x000001ACBB940000-memory.dmp
memory/5320-2-0x000001ACBB8E0000-0x000001ACBB914000-memory.dmp
memory/5320-3-0x000001ACD4350000-0x000001ACD4362000-memory.dmp
memory/5320-4-0x000001ACD43B0000-0x000001ACD43EC000-memory.dmp
memory/5320-5-0x000001ACD5200000-0x000001ACD5238000-memory.dmp
memory/5320-8-0x000001ACD43F0000-0x000001ACD43F8000-memory.dmp
memory/5320-9-0x000001ACD5240000-0x000001ACD52A2000-memory.dmp
memory/5320-6-0x000001ACD4330000-0x000001ACD433A000-memory.dmp
memory/5320-7-0x000001ACD4370000-0x000001ACD4396000-memory.dmp
memory/5320-10-0x000001ACD52A0000-0x000001ACD52E2000-memory.dmp
memory/5320-11-0x000001ACD4340000-0x000001ACD434A000-memory.dmp
memory/5320-12-0x000001ACD4400000-0x000001ACD440A000-memory.dmp
memory/5320-13-0x000001ACD5310000-0x000001ACD532A000-memory.dmp
memory/5320-14-0x000001ACD5580000-0x000001ACD55A2000-memory.dmp
memory/5320-15-0x000001ACBB930000-0x000001ACBB940000-memory.dmp
memory/5320-20-0x000001ACD43A0000-0x000001ACD43B2000-memory.dmp
memory/5320-43-0x000001ACD57C0000-0x000001ACD57D4000-memory.dmp
memory/5320-42-0x000001ACD57B0000-0x000001ACD57C0000-memory.dmp
memory/5320-41-0x000001ACD5780000-0x000001ACD57B2000-memory.dmp
memory/5320-40-0x000001ACD5750000-0x000001ACD5784000-memory.dmp
memory/5320-39-0x000001ACD5740000-0x000001ACD5756000-memory.dmp
memory/5320-38-0x000001ACD5570000-0x000001ACD557C000-memory.dmp
memory/5320-37-0x000001ACD5300000-0x000001ACD530A000-memory.dmp
memory/5320-36-0x000001ACD5700000-0x000001ACD573A000-memory.dmp
memory/5320-35-0x000001ACD52F0000-0x000001ACD5304000-memory.dmp
memory/5320-34-0x000001ACD56D0000-0x000001ACD56FA000-memory.dmp
memory/5320-33-0x000001ACD5650000-0x000001ACD56D0000-memory.dmp
memory/5320-32-0x000001ACD5600000-0x000001ACD564C000-memory.dmp
memory/5320-31-0x000001ACD55B0000-0x000001ACD55FA000-memory.dmp